F5 BIG-IP AFM Daemons

This page is an overview of F5^® BIG-IP^® AFM^™ daemons. For information about other versions, refer to the following pages:

For information about daemons from other modules, refer to the following pages.

When the BIG-IP system is licensed with the BIG-IP AFM, a separate set of processes are initiated in addition to the standard set of BIG-IP processes. The following table lists the core BIG-IP AFM services and indicates the impact to the BIG-IP AFM system operation if the service is not running:

Overview of F5 BIG-IP AFM daemons
Daemon	Description	Impact if not running	Relevant log files
autodiscd	BIG-IP 15.0.0 and later. Automatically discover and detect individual servers and services on a subnet. You can promote these auto-discovered services to protect objects or virtual servers. It is part of the BIG-IP AFM system.	Automatic discovery of services does not function.	/var/log/ltm
avrd	Reporting/charts; The AVR daemon is used by BIG-IP AFM in conjunction with monpd with no additional provisioning.	No reporting charts displayed.	/var/log/avr/avrd.log
dwbld	The dynamic white/black daemon (dwbld) is a Control Plane daemon which supports the BIG-IP AFM IP intelligence feature.	Enforcement of dwbl will not occur.	/var/log/dwbl/dwbld.log
pccd	The pccd is the Packet Correlation Classification Daemon. This daemon detects firewall configuration changes, re-compiles the new configuration, and serializes for TMM to enforce.	Unable to detect and compile firewall configuration changes. Hence the changes made to firewall configuration are not enforced by TMM. Note The firewall configuration that was successfully serialized for TMM before pccd is down continues to be enforced even if pccd is down at that instance.	/var/log/ltm /var/log/ts/bd.log
pgadmind	Starts up PostgreSQL server process and monitors it.	If the Inline Rule Editor is enabled, and the PostgreSQL server process is not running due to the pgadmind daemon being stopped, firewall rules cannot be viewed or edited either using the Inline Rule Editor page or the default firewall rule editor UI.	/var/log/ltm
mgmt_acld	mgmt_acld is primarily responsible for maintaining statistics, logging, and reporting of Management Port AFM Rules. In addition, it also periodically updates the statistics counters for Management Port Rules.	Counters, logging, and reporting for Management Port Rules will not work as expected.	/var/log/ltm
monpd	Reporting/charts used in conjunction with the avrd process.	No reporting charts are displayed.	/var/log/avr/monpd.log
mysqld	The mysqld process is the database server storing data for Reporting/charts and Event Logs reports.	No reporting charts or Event Logs reports are displayed.	/var/lib/mysql/mysqld.err
fslogd logmysqld	These two daemons populate the event logs generated by TMM and other related daemons into the MySQL database.	Events from TMM and other related daemons will not be logged into MySQL database.	None
sshplugin	The sshplugin daemon is used by BIG-IP AFM which allows to perform protocol-specific limitations on “who” can do “what” on specific SSH connections to “where”.	No capability to determine protocol-specific limitations by the specific SSH connections.	/var/log/sshplugin

Restarting BIG-IP AFM processes

If a BIG-IP AFM daemon is not running or needs restart, F5 recommends that you restart all of the BIG-IP AFM daemons in the proper order. To do so, type the following command:

tmsh restart /sys service pccd

Restarting BIG-IP AFM processes

Supplemental Information